Which versions of LiteLLM are affected by CVE-2026-42271?

LiteLLM proxy server versions 1.74.2 through 1.83.6 contain a remote command execution vulnerability that allows any authenticated user with a valid API key to execute arbitrary commands with proxy…. A patch is available.

Is there a public PoC exploit available for CVE-2026-42271?

Yes, a public proof-of-concept exploit is available for CVE-2026-42271. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-42271?

Within 24 hours: Inventory all LiteLLM proxy deployments and confirm versions currently in use; restrict network access to proxy servers to trusted hosts only and review API key distribution practices. Within 7 days: Upgrade all instances to LiteLLM version 1.83.7 or later; rotate all API keys post-upgrade. Within 30 days: Conduct audit of proxy logs for unauthorized command execution attempts; review role-based access controls and implement principle of least privilege for API key scopes.

LiteLLM CVE-2026-42271

Q: What is the CVSS score of CVE-2026-42271?

CVE-2026-42271 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-28507 HIGH

Command Injection (CWE-77)

2026-05-08 GitHub_M

GHSA-v4p8-mg3p-g94g

Command Injection Litellm

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Added to CISA KEV

Jun 08, 2026 - 17:16 CISA

Patch available

May 08, 2026 - 05:01 EUVD

Source Code Evidence Fetched

May 08, 2026 - 04:32 vuln.today

Analysis Generated

May 08, 2026 - 04:32 vuln.today

CVSS changed

May 08, 2026 - 04:22 NVD

8.7 (HIGH)

CVE Published

May 08, 2026 - 03:35 nvd

HIGH 8.7

DescriptionCVE.org

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it - POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list - accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user - including holders of low-privilege internal-user keys - could therefore run arbitrary commands on the host. This issue has been patched in version 1.83.7.

Articles & Coverage 1

POC CVE-2026-42271: Proof-of-Concept Exploit (Draft) Jun 09, 2026

AnalysisAI

Remote command execution in LiteLLM proxy server versions 1.74.2 through 1.83.6 allows any authenticated user to execute arbitrary commands on the host system. Two MCP (Model Context Protocol) test endpoints accept stdio transport configurations including command, args, and env fields, then spawn the supplied command as a subprocess with proxy process privileges. Authentication with any valid API key, including low-privilege internal-user keys, bypasses intended PROXY_ADMIN role restrictions. Patch available in version 1.83.7. No CISA KEV listing or public exploit code identified at time of analysis, though EPSS scoring is not provided in available data.

Technical ContextAI

LiteLLM is an AI Gateway proxy server that provides OpenAI-compatible interfaces for various LLM APIs. The vulnerability affects MCP (Model Context Protocol) server testing functionality introduced in version 1.74.2. MCP uses stdio transport to communicate with external tools/servers, requiring command execution on the host. The POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list endpoints accept JSON configurations containing command, args, and env parameters for stdio transport. These endpoints lack proper authorization checks, validating only API key presence without verifying PROXY_ADMIN role membership. This represents CWE-77 (Command Injection) combined with an authorization bypass, where user-controlled input flows directly into subprocess.spawn() or equivalent system calls. The affected CPE is cpe:2.3:a:berriai:litellm:*:*:*:*:*:*:*:*, covering all deployment methods (pip package, Docker container).

RemediationAI

Upgrade to LiteLLM version 1.83.7 or later, which enforces PROXY_ADMIN role checks on both vulnerable endpoints. For pip installations, run 'pip install --upgrade litellm'. For Docker deployments, pull ghcr.io/berriai/litellm:v1.83.7-stable and verify image signature using cosign per vendor instructions at https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable. If immediate upgrade is not feasible, block POST requests to /mcp-rest/test/connection and /mcp-rest/test/tools/list at reverse proxy or API gateway level using URL path filtering. This workaround prevents exploitation but disables MCP server preview functionality. Additionally, audit all issued API keys and revoke unnecessary low-privilege internal-user keys to reduce attack surface. Review proxy process security context and consider running LiteLLM with reduced privileges or in isolated containers to limit blast radius. No additional code changes or configuration modifications required after upgrading to patched version.